There is a room under every life now. A low hum of everything you have ever written down, every contact, every decision with its reasons still attached, sitting in one place and vibrating at a frequency only you are supposed to hear. The industry calls it memory and wants to host it. I call it the floor, and the floor is not for rent.
I have spent the last stretch of nights building the thing this essay describes, and then asking strangers on the internet to break it. This is what survived.
Two bad bargains
Every current answer to personal AI memory is one of two trades.
The first trade is convenience for custody. Cloud assistants with memory features will hold your context, reason over it, and get genuinely better with every byte you give them. In exchange, your context lives on infrastructure you do not control, under retention policies you did not write, one acquisition or subpoena away from being someone else’s asset. The trust model is a settings page.
The second trade is sovereignty for capability. Run everything local and you keep custody of every byte. You also cap your reasoning at whatever fits on your hardware, forever. The moment a hard problem demands frontier-level reasoning, you end up pasting context into a cloud tab by hand and hoping you caught everything sensitive on the way out. Redaction by vibes.
Both trades accept the same premise: that capability and custody have to live in the same place. That premise is the mistake.
The threat model is boring
When I describe this to people, someone always reaches for the spy movie. If a state actor is watching your GPU, you need a different kind of help.
But that is not the adversary. The adversary is boring. It is a retention window. A training pipeline. A breach dump. A terms-of-service update. An acquisition that changes what the company is. None of it requires targeting you, because it happens to everyone by default. Custody is the whole game. What enters someone else’s context window is gone, and no amount of policy language brings it back.
The night the polite version failed
I believed for a while that careful instructions were enough. My assistant held years of my context and carried strict rules about what it could say and to whom. So I tested it. I had someone close to me message it and try, deliberately, to talk it into giving things up.
It refused the bait. Every fishing question, correctly declined. And then, in the middle of explaining one of those refusals, it printed my real phone number into the conversation. Nobody had asked for the number. The model reached into memory and set it in prose, helpfully, the way models do.
That is the finding. A capable model is a great employee and a terrible vault. It does not understand secrecy; it predicts tokens, and everything it can see is a token it might predict. If the model has access, it can emit what it has access to. Tuning behavior changes the odds. It does not change the wiring.
So the control has to live in the data path, not the behavior path.
The architecture
What I run now is two tiers and a boundary.
An inner process, a small local model, is the only reader of the personal store. All of it, notes, contacts, history, sits behind that single reader, tagged.
An outer process, whatever frontier model the task deserves, does the heavy reasoning. It is treated as very smart untrusted labor. It holds no state, keeps no memory of me, and never touches the store.
Between them sits a gate. Anything bound for the outer crosses it, and at the crossing the inner decides scope, applies redaction, and writes the event to a local, signed, hash-chained log. I formalized the log into a small wire protocol, AIP, because the record of what crossed matters as much as the crossing. Every approval is a signed event. Every denial is a signed event.
The outer never pulls. The inner never pushes raw. The outer receives a constructed prompt, never a query against the store. In pipeline terms, the inner is the only reader of the raw lake, and the outer is a downstream processor that gets a prepared, filtered dataset scoped to one request.
Why the guard is dumb on purpose
The objection I respect most goes like this: any privacy mechanism that depends on a weaker model policing a stronger one is inadequate. The weak model loses the argument every time.
Agreed, completely. Which is why the gate never enters the argument. The inner does not debate the outer. It checks tags. Data marked personal does not cross, no matter how elegant the request, because the gate is not evaluating persuasiveness. It is enforcing a rule it cannot be talked out of. A door lock does not need to be smarter than the burglar.
This matters more every quarter, because the frontier is something you rent, not something you vet. Its alignment, its jurisdiction, its retention policy are decisions made by other people under competitive pressure you have no vote in. An architecture that depends on the capable model being trustworthy inherits every compromise that race forces. An architecture that treats the capable model as untrusted labor does not care who wins.
And when the inner errs, it errs in one direction. Where redaction requires judgment, a small model will sometimes get it wrong, so the posture is conservative and the failure lands as a false denial, not a leak. The system fails closed. I pay that tax knowingly. It is the cheapest tax in the building.
Honest limits
Three things this does not solve, stated plainly because the pattern only deserves trust if its edges are visible.
Reconstruction from what legitimately crosses. Narrow slices still carry signal, and a capable model can infer from patterns in what I chose to send. I can bound this with scope discipline and audit it after the fact. I cannot zero it. Anyone who tells you they can is selling something.
Redaction quality. Rules plus review is not a proof. Nothing here is formally verified.
The accumulation problem. There is no leakage budget across requests yet, no principled ceiling on what a long sequence of small crossings adds up to. That is the open problem I most want to see solved, and I did not solve it.
The floor
Here is what I know after the strangers took their swings. The trick was never to build a guard clever enough to win the conversation. The trick was to build a floor that does not move regardless of how the conversation goes. Everything above the floor can churn. Models will leapfrog each other, companies will pivot, the race will do what races do, and none of it matters to the room underneath, because the room was never on the table.
The inner holds. The outer works. The gate writes it all down.
Low end first. The rest is arrangement.